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IQ.  (C)  Summary:  On  May  2,  Hong  Kong's  Privacy  Commissioner 

confirmed  to  poloff  that  the  Commission  was  investigating 
whether  information  provided  by  Yahoo!  regarding  mainland 
journalist  Shi  Tao,  had  violated  the  territory's  Personal 
Data  (Privacy)  Ordinance.  Although  Shi  is  not  a Hong  Kong 
resident,  the  International  Chinese  Pen  Center,  an 
organization  of  exiled  mainland  writers,  has  filed  a 
complaint  with  the  privacy  watchdog  on  Shi's  behalf.  Of 
particular  concern  to  lawmakers  and  human  rights  activists 
was  speculation  that  Yahoo! 's  Hong  Kong-based  operations  had 
provided  information  to  PRC  law  enforcement  officials  — a 
clear  violation  of  Hong  Kong's  status  as  an  autonomous 
territory  with  a separate  legal  structure.  In  response, 
representatives  of  Yahoo!  have  emphasized  that  Yahoo!  China, 
not  Yahoo!  Hong  Kong,  responded  to  the  request  from  mainland 
law  enforcement  in  Shi's  case.  However,  it  is  unclear  what 
role  Yahoo!  Holdings  (Hong  Kong)  Limited,  the  holding  company 
which  previously  owned  both  Yahoo!  China  and  Yahoo!  Hong  Kong 
at  the  time  of  Shi's  arrest,  played  in  passing,  authorizing, 
or  directing  the  transfer  of  data  to  PRC  authorities;  it  may 
therefore  be  the  current  focus  of  the  Privacy  Commission's 
investigation.  End  Summary. 

Commission  Investigates  Yahoo! 


112.  (C)  On  May  2,  Hong  Kong's  Privacy  Commissioner  for 
Personal  Data  Roderick  Woo  confirmed  to  poloff  that  the 
Commission  was  investigating  whether  information  provided  by 
Yahoo!  regarding  mainland  journalist  Shi  Tao,  had  violated 
the  territory's  Personal  Data  (Privacy)  Ordinance.  According 
to  Shi's  mainland  court  verdict,  Yahoo!  Holdings  (Hong  Kong) 
Limited  provided  information  to  China's  state  security 
authorities  which  later  led  to  Shi's  arrest  and  conviction. 
Although  Shi  is  not  a Hong  Kong  resident,  Zhang  Yu,  Secretary 
General  of  the  International  Chinese  Pen  Center,  an 
organization  of  exiled  mainland  writers,  filed  a complaint 
with  the  Privacy  Commission  — a statutory  body  separate  from 
the  Hong  Kong  Government  and  charged  with  protecting  the 
privacy  of  personal  data  --  on  Shi's  behalf.  During  the 
meeting,  Woo  was  not  forthcoming  about  the  details  of  the 
case,  citing  the  sensitive  nature  of  the  ongoing 
investigation . 

113.  (C)  In  his  initial  response  to  the  media  storm  regarding 
Yahoo! 's  role  in  Shi  Tao ' s imprisonment  last  September, 

Yahoo!  co-founder  Jerry  Yang  did  not  deny  that  his  company 
had  provided  information  to  mainland  authorities;  he  instead 
emphasized  that  the  company  had  no  choice  but  to  obey  the 
national  laws  in  the  countries  in  which  it  operated. 


According  to  press  reports,  a total  of  four  mainland  internet 
writers  have  been  imprisoned  (Shi  Tao,  10  years;  Li  Zhi,  8 
years;  Jiang  Lijun,  4 year;  and  Wang  Xiaoning,  10  years) 
after  Yahoo!  Holdings  (Hong  Kong)  Limited  turned  over 
information  regarding  their  yahoo.cn  email  accounts. 

Yahoo!  Denies  Violating  Hong  Kong  Autonomy 


14.  (C)  Of  particular  concern  to  Hong  Kong  lawmakers  and  human 
rights  activists  was  the  possibility  that  the  Yahoo! 
operations  based  in  Hong  Kong  had  provided  information  to  PRC 
investigators,  a clear  violation  of  Hong  Kong's  status  as  an 
autonomous  territory  with  a separate  legal  structure.  In  two 
separate  instances,  representatives  of  Yahoo!  vigorously 
denied  that  Yahoo!  Hong  Kong  had  provided  information  on  Shi 
Tao  to  mainland  authorities.  In  October  2005,  Hong  Kong's 
legislature  convened  a special  Panel  meeting  to  ascertain 
whether  the  territory's  privacy  laws  had  been  violated. 

Allan  Kwan,  Managing  Director  of  Yahoo!  Holdings  (Hong  Kong) 
Limited  stated  in  an  October  28,  2005  letter  to  Legco  that 
"Yahoo!  Hong  Kong  has  not  been  involved  in  any  disclosure  of 
information,  including  that  relating  to  Shi  Tao,  to  the 
mainland  authorities ...  Since  compliance  with  law  enforcement 
mandates  in  mainland  China  are  handled  by  Yahoo!  China, 

Yahoo!  Hong  Kong  is  not  aware  of  what  information  was 
provided  in  that  case  or  the  circumstances  thereof.  Our 
understanding  of  this  matter  is  that  the  data  disclosure  was 
made  by  the  Yahoo!  China  operation  for  a PRC  user  in  China 
holding  a .cn  email  account.  Neither  Yahoo!  Hong  Kong  nor 
any  .hk  user  data  was  involved,  and  as  such  we  do  not  believe 
that  there  are  any  implications  with  respect  to  the  Personal 
Data  (Privacy)  Ordinance."  Furthermore,  on  February  15, 
during  testimony  before  the  U.S.  House  Committee  on 
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International  Relations  on  the  issue  of  the  Internet  in 
China,  Michael  Callahan,  Senior  Vice  President  and  General 
Counsel  for  Yahoo!  Inc.  again  stated  that  Yahoo!  Hong  Kong 
"was  not  involved  in  any  disclosure  of  information  about  Mr. 
Shi  to  the  Chinese  Government." 

Privacy  Violation? 


115.  (C)  At  issue  is  the  role  of  three  separate  entities 
potentially  involved  in  the  case  of  Shi  Tao:  Yahoo!  China, 
Yahoo!  Hong  Kong,  and  Yahoo!  Holdings  (Hong  Kong)  Limited, 
the  holding  company  which  previously  owned  the  former  two 
companies.  Since  August  of  last  year,  Yahoo!  China  has  been 
owned  and  controlled  by  Alibaba.com  Corporation,  a Chinese 
technology  firm.  It  is  clear  that  Yahoo!  China  responded  to 
a request  from  mainland  law  enforcement  authorities  regarding 
Shi  and  that  Yahoo!  Hong  Kong  played  no  role  in  this  transfer 
of  user  information.  However,  what  is  unclear  is  the  role  of 
the  holding  company,  Yahoo!  Holdings  (Hong  Kong)  Limited  in 
passing,  authorizing,  or  directing  the  transfer  of  data  to 
PRC  authorities  and  may  be  the  focus  of  the  Privacy 
Commission's  investigation.  Woo  confirmed  that  if  the 
complainant  (in  this  case,  the  International  Chinese  Pen 
Center)  has  legal  standing  to  lodge  a complaint,  then  the 
Commission  would  be  obligated  to  investigate  the  case.  If 
Yahoo!  — whether  it  is  Yahoo!  Hong  Kong,  or  Yahoo!  Holdings 
(Hong  Kong)  Limited  is  found  to  have  violated  Shi  Tao ' s 
privacy,  then  the  Privacy  Commissioner  may  serve  an 
enforcement  notice  on  the  company  which  may  carry  a penalty 
of  a fine  and/or  imprisonment. 

Vo.  (C)  The  Privacy  Commissioner  told  the  "South  China  Morning 
Post"  on  April  26  that  Shi's  case  was  challenging  because, 
"there  are  difficulties  with  the  technical  definition  of  the 
term  'personal  data'  and  (issues)  involving  jurisdictional 
points."  Moreover,  the  Ordinance  also  provides  for 
exemptions  to  the  privacy  law  "where  their  application  is 
likely  to  prejudice  certain  competing  public  or  social 
interests,  such  as  security,  defense  and  international 


relations;  prevention  or  detection  of  crime;"  etc.  For 
example,  on  May  10,  the  Court  of  First  Instance  issued  a 
court  order  requiring  four  Internet  service  providers  to 
provide  the  identities  of  49  users  who  allegedly  downloaded 
local  films  illegally.  In  this  case,  the  Hong  Kong  Court 
found  that  the  users ' privacy  was  exempt  from  the  Privacy 
Ordinance  in  order  to  detect  criminal  activity. 

Cunningham 


